Open-source alternatives to VirtFuzz

go-fuzz is a coverage-guided randomized testing tool for identifying crashes and logic bugs in Go code. It consists of a fuzzer that evolves random inputs based on code execution paths, an instrumentation tool that produces binaries for tracking coverage, and a seed corpus manager. The tool utilizes compile-time binary instrumentation to monitor branch coverage and employs a feedback-driven mutation loop to prioritize inputs that reach new sections of the codebase. It includes capabilities for comparative differential testing to identify logic errors by executing different implementations of

Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)

Syzkaller is an unsupervised, coverage-guided kernel fuzzer that automatically generates and mutates system call sequences to find bugs in operating system kernels. It operates without human intervention, using a closed feedback loop of input generation, execution, crash detection, and corpus refinement to continuously explore kernel code paths. The fuzzer distinguishes itself by supporting multiple operating system kernels, including Linux, FreeBSD, and Windows, through per-platform syscall harnesses that abstract system call interfaces behind a common driver. It uses declarative description

Bug hunting through fuzzer/*-sanitizer/etc...

RetroWrite -- Retrofitting compiler passes through binary rewriting

SOSP'25 Automatic checker synthesis for system-level static analysis

Linux kernel source tree

Peach is a fuzzing framework which uses a DSL for building fuzzers and an observer based architecture to execute and monitor them.

AFL/QEMU fuzzing with full-system emulation.

MCP agent for Linux kernel PATCH, syzkaller

Cloudfuzzer is a cloud fuzzing framework. Purpose of cloudfuzzer is to make it possible to easily run automated fuzz-testing in cloud environment.

ISSTA 2025 Unlocking Low Frequency Syscalls in Kernel Fuzzing with Dependency-Based RAG

Ph.D. student in the Department of Computer Science & Engineering, at the University of Minnesota (Twin Cities)

Dynamic Race Detection with LLVM compiler (Runtime Verification 2011, co-authored with Kostya Serebryany, Timur Iskhodzhanov, Dmitriy Vyukov)

ANTLR v4 grammar-based test generator

The companion repository for the 39C3 talk: Build a Fake Phone, Find Real Bugs: Qualcomm GPU Emulation and Fuzzing with LibAFL QEMU

🌪️ Application fuzzer

Coverage based JVM Fuzz testing tool.

StepStone contains two main components for GPU syscall fuzzing:

BoKASAN: Binary-only Kernel Address Sanitizer for Effective Kernel Fuzzing

Agamotto: Accelerating Kernel Driver Fuzzing with Lightweight Virtual Machine Checkpoints

MoonShine selects compact and diverse seeds for OS fuzzers from system call traces of real world programs. Please see our USENIX'18 paper MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation for more details. Currently, MoonShine can only generate seeds for Syzkaller on Linux.